Re: [PATCH 2/3] arm64: gcs: Allow PAGE_NONE mappings for NUMA balancing

["David Hildenbrand (Arm)" <david@kernel.org>]

On 2/20/26 15:05, Catalin Marinas wrote:
> vm_get_page_prot() short-circuits the protection_map[] lookup for a
> VM_SHADOW_STACK mapping since its permissions are special. However, it
> also ignores PAGE_NONE mappings used for NUMA balancing by creating an
> accessible PTE.
> 
> Special-case the VM_NONE permission to create an invalid PTE even if it
> is a GCS mapping.
> 
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Fixes: 6497b66ba694 ("arm64/mm: Map pages for guarded control stack")
> Cc: <stable@vger.kernel.org>
> Cc: Mark Brown <broonie@kernel.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: David Hildenbrand <david@kernel.org>
> ---
>   arch/arm64/mm/mmap.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
> index 2e404441063b..f8993e3fa5d1 100644
> --- a/arch/arm64/mm/mmap.c
> +++ b/arch/arm64/mm/mmap.c
> @@ -87,7 +87,15 @@ pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
>   
>   	/* Short circuit GCS to avoid bloating the table. */
>   	if (system_supports_gcs() && (vm_flags & VM_SHADOW_STACK)) {
> -		prot = pgprot_val(PAGE_GCS_RO);
> +		/*
> +		 * Allow PAGE_NONE for NUMA balancing, otherwise use
> +		 * PAGE_GCS_RO. The permission will be made writeable
> +		 * (PAGE_GCS) on a GCS fault.
> +		 */
> +		if (vm_flags & (VM_READ | VM_WRITE))

Could consider using VM_ACCESS_FLAGS here. For Shadow stacks we'd never 
expect executable properties.

> +			prot = pgprot_val(PAGE_GCS_RO);
> +		else
> +			prot = pgprot_val(protection_map[VM_NONE]);

change_protection() documents that "This is assuming that NUMA faults 
are handled using PROT_NONE. If an architecture makes a different 
choice, it will need further changes to the core."

So task_numa_work()->change_prot_numa()->change_protection() passes 
"newprot = PAGE_NONE".

Where is the vm_get_page_prot() called on that path where your change 
would make a difference?

I'd thing that vm_get_page_prot() gets only invoked through a "proper" 
mpotect() in 
mprotect_fixup()->vma_set_page_prot()...->vm_get_page_prot(), not for 
NUMA hinting that leaves the VMA untouched.


OTOH, I wonder whether mprotect(PROT_NONE) could trigger the path you 
thought of above.

-- 
Cheers,

David